Regedit Windows Defender Real-Time Protection Key
This guide details the exact Windows Registry path used to store Windows Defender real-time protection policy overrides, explaining the relevant registry keys, their specific DWORD values, and how these settings control real-time monitoring behavior across Windows systems.
Primary Registry Key Location
Policy overrides for Windows Defender (Microsoft Defender Antivirus) real-time protection are stored in the local machine policies hive. The primary Registry key path is:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
If this subkey does not exist, it is typically created automatically when Group Policy configurations for Microsoft Defender are defined, or it can be created manually by an administrator.
Key Values and Definitions
Within the Real-Time Protection key, several DWORD
(32-bit) values manage specific override behaviors:
DisableRealtimeMonitoring- Value
1: Disables real-time scanning and monitoring. - Value
0: Enables real-time scanning (default system behavior).
- Value
DisableBehaviorMonitoring- Value
1: Disables behavior monitoring of running processes. - Value
0: Enables behavior monitoring.
- Value
DisableOnAccessProtection- Value
1: Disables scanning of files when they are accessed or executed. - Value
0: Enables file access scanning.
- Value
DisableScanOnRealtimeEnable- Value
1: Disables the quick scan that runs whenever real-time protection is turned on. - Value
0: Enables the quick scan upon activation.
- Value
DisableIOAVProtection- Value
1: Disables the scanning of downloaded files and attachments. - Value
0: Enables download and attachment scanning.
- Value
Important Operational Considerations
To manually modify or enforce policies via the Registry on modern versions of Windows 10 and Windows 11, Tamper Protection must be turned off in the Windows Security settings first. If Tamper Protection is active, Windows will automatically revert or ignore manual changes made to the Windows Defender policy registry keys.